Splunk Search

Pass one field from multiple fields returned by subsearch


Hi All,

I have a search query like below.

[search A | fields B,C] | search (D OR E) | fields F | table, B,C,F.

Search A returns two fields.
I need to pass the field C to the master search but still want to retain the field B for the final results.
The above query passes both fields B & C to the master search and hence the master search is not return any results.

Is there possible solution for this?


0 Karma

Path Finder

Hi Murali

I had alot of issues with my subsearches but i found the best way to get back multiple fields from from a subsearch was using Eval (making sure the results are returned using a field called 'query' (dont ask me why)) and then rexing out your fields from the result. Its not very elegant but it gives you visibility and control over the data you are returning.

Im not very good at written explanations so maybe a code example would help:

eval f=[search A | fields B,C | eval query=B+";"+C | table query ] | rex (insert splitting regex here) | search (D OR E) | fields F | table, B,C,F
0 Karma


No. The subsearch emits a filter string containing all values for B and C. There's no separate "channel" where field values can be returned from a subsearch without having them emitted as a filter string. Depending on your exact scenario, you might want to look into using join, or if you have fairly static data, consider putting your B values in a lookup.

0 Karma


thanks @Ayn. I have been using join till now for this query but that has performance impact, so I am exploring other options.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...